1. Field of the Invention
The present invention relates generally to computer security, and more particularly but not exclusively to methods and apparatus for anti-malware scanning in virtualization environments.
2. Description of the Background Art
Virtual machines, in general, are well known in the art of computer science. Generally speaking, a virtual machine is a software implementation of a machine (i.e., a computer) that executes programs like a physical machine. Multiple virtual machines may run on a single computer hardware platform, which is also referred to as “host machine.” Although the virtual machines run in the same host machine, each virtual machine has its own operating system and functions as a computing environment separate from the other virtual machines. Still, the virtual machines share the same disk I/O (input/output) and processor resources of the same host machine.
Malware include computer viruses, worms, Trojans, rootkits, spyware and other forms of malicious codes. A virtual machine may include an anti-malware to guard against malware. Typical anti-malware comprises a scan engine and a pattern. The pattern comprises signatures of known malware and other information for identifying malware. In an example operation, the anti-malware may perform an anti-malware scan to compare data against the pattern using a pattern-matching algorithm. Because an anti-malware scan involves a lot of disk I/O and processor computation, anti-malware scanning often significantly impacts the performance of the target virtual machine. Simultaneous anti-malware scanning on several virtual machines running on the same host machine may cause system thrashing.
Embodiments of the present invention pertain to anti-malware scanning on virtual machines, and are especially advantageous in high-availability virtualization environments where virtual machines are dynamically migrated from one host machine to another.